Windows Server

Asgard Hostmaster · Guest

Hi folks,
I'm still struggling with getting FRS working properly. To recap, the only
thing i'm trying to replicate is SYSVOL. I've been through all the KBs and
such I can find, and have cleared a few issues, but still no luck getting it
working properly.

Checking the NTFRS logs, I'm down to this repeated error -

<FrsHashCalcString: 3156: 4832: S0: 21:05:06> Name =
S-1-5-21-484763869-1972579041-1417001333-1809
<SERVER_FrsRpcSendCommPkt: 3156: 442: S0: 21:05:06> ++ ERROR - Invalid
Partner: AuthClient:ASGARD\SB-2$,
AuthSid:S-1-5-21-484763869-1972579041-1417001333-1809

I'm very confident the problem relates to this, however I can't find it
addressed anywhere on the MS site or newsgroups or elsewhere on the net.
I've tried resetting the machine password on SB-2 using netdom, but the
error is still there. How is security defined for FRS machine transactions?

thanks,
David

Asgard Hostmaster · Guest

just to add, the NTFRS logs on the other server say -

WS ERROR_ACCESS_DENIED

So it seems obvious to be some kind of permissions problem. Perhaps a
Kerberos problem?

"Asgard Hostmaster" <hostmaster@asgard_remove_.net> skrev i meddelandet
news:uUOF1MZsEHA.2460@TK2MSFTNGP09.phx.gbl...

Asgard Hostmaster · Guest

Removing and readding each Domain Controller in turn has fixed this error.
Now I'm managing to replicate SYSVOL and two other folders, but the third
refuses. Error in ntfrs.log now is -

<SndCsMain: 3200: 867: S0: 07:24:06> :SR: Cmd 0026f378, CxtG 4281a4ba, WS
ERROR_INVALID_DATA, To SB-2.mydomain.net Len: (388) [SndFail - rpc call]
<SndCsMain: 3200: 889: S0: 07:24:06> :SR: Cmd 0026f378, CxtG 4281a4ba, WS
ERROR_INVALID_DATA, To SB-2.mydomain.net Len: (388) [SndFail - Send Penalty]
<FrsDsFindComputer: 3392: 8786: S2: 07:25:48> :DS: Computer FQDN is
cn=sb-3,ou=domain controllers,dc=mydomain,dc=net
<FrsDsFindComputer: 3392: 8792: S2: 07:25:48> :DS: Computer's dns name is
sb-3.mydomain.net
<FrsDsFindComputer: 3392: 8806: S2: 07:25:48> :DS: Settings reference is
cn=ntds
settings,cn=sb-3,cn=servers,cn=san-antonio,cn=sites,cn=configuration,dc=mydomain,dc=net
<FrsDsGetSubscribers: 3392: 8239: S0: 07:25:48> :DS: No NTFRSSubscriber
object found under cn=dfs volumes,cn=ntfrs subscriptions,cn=sb-3,ou=domain
controllers,dc=mydomain,dc=net!
<FrsDsGetSubscribers: 3392: 8239: S0: 07:25:48> :DS: No NTFRSSubscriber
object found under cn=2076db4e-718a-4a61-ac1d-9ae239578d26,cn=dfs
volumes,cn=ntfrs subscriptions,cn=sb-3,ou=domain
controllers,dc=mydomain,dc=net!
<RcsCreateSeedingCxtion: 2828: 6938: S0: 07:25:48> :X: ERROR - no parent
computer for DFS|CLIENTSITES : WStatus: ERROR_FILE_NOT_FOUND

Any suggestions on where to look now?

"Asgard Hostmaster" <hostmaster@asgard_remove_.net> skrev i meddelandet
news:OQhFaQZsEHA.2800@tk2msftngp13.phx.gbl...

Glenn LeCheminant · Guest

FRS stores all its topology info in AD.
this diag spells it out pretty clearly

Asgard Hostmaster · Guest

Hi Glen,

Thanks very much for the reply! The cn=2076db4e-718a-4a61-ac1d-9ae239578d26
object itself has no frsMemberReference attribute, only
frsMemberReferenceBL, which is not set. Beneath it are the 3 subscriber
objects, two of which are replicating fine and one of which, DFS|CLIENTSITES
is not. All of them have frsMemberReference set correctly.

"Glenn LeCheminant" <the.only@gmail.com> skrev i meddelandet
news:eY%23mUW6sEHA.2804@TK2MSFTNGP14.phx.gbl...

Glenn L · Guest

Run FRSDIAG against the failing member.
then paste the contents of FRS-DS config log into this thread.
Can't remember the exact name of the log file, but it is the one that dumps
the FRS topology from AD into a text file.
I should be able to see from that if the error in the debug log is bogus or
not.

Glenn

"Asgard Hostmaster" <hostmaster@asgard_remove_.net> wrote in message
news:%23yOn6X7sEHA.820@TK2MSFTNGP12.phx.gbl...

Asgard Hostmaster · Guest

Hi Glen,
Results are posted under the thread "ACLs on FRS files"
David

"Glenn L" <the.only@gmail.com> wrote in message
news:uBkmTB8sEHA.3912@TK2MSFTNGP10.phx.gbl...

Glenn L · Guest

Ah RPC failures, I zoned in on the NTFRS subscriber objects and didn't even
see these in the thread before.

EPT_S_NOT_REGISTERED, To sb-3.mydomain.net Len: (356) [SndFail - rpc
exception]
<SndCsMain: 2432: 895: S0: 13:59:39> :SR: Cmd 00237200, CxtG 82382b81, WS
EPT_S_NOT_REGISTERED, To sb-3.mydomain.net Len: (356) [SndFail - Send
Penalty]

Perhaps the ntfrs subscriber errors are bogus after all.

RPC failures are typically the result of port filtering between the two
networks.
I have lost track of which replica is failing.
The best way IMHO to track down RPC failures is to do a simultaneous network
trace from each replica good gone and bad one.

Stop the FRS service on the bad replica member.
start the simultaneous network traces
start the service and let it churn for a couple minutes.
then stop the traces.

You should be looking for dropped packets. Specifically during the SMB
session setup.
basically the process works are follows. client sends SMB negotiate request
to port 135 on server.
They negotiate SMB dialect,
client sends RPC endpoint mapper request to port 135 on the server.
server responds with high port to communicate on. Typically in the
1025-5000 range.
client then initiates session setup on using the high port as the
destination port.
I often see this high port being blocked at firewalls.
This is a classic cause for repeated 13508s.

--
Glenn L
CCNA, MCSE 2000, MCSE 2003 + Security

--
Glenn L
CCNA, MCSE 2000, MCSE 2003 + Security

"Asgard Hostmaster" <hostmaster@_remove_asgard.net> wrote in message
news:OQLpPkttEHA.1008@tk2msftngp13.phx.gbl...

Asgard Hostmaster · Guest

hmmm, I guess this would account for problems coming and going - it depends
which of the upper ports might be blocked and which RPC requests? I asked
the datacentre a couple of weeks ago if they where blocking any ports on
their internal routers that might be causing problems but I had no reply.
I'll try again!

Incidentally, if this is a "classic cause" it should be on a KB or
something! Not something I'd come across as a potential cause of 13508s,
though I suspected it.

"Glenn L" <the.only@gmail.com> wrote in message
news:%235j8FxutEHA.1720@TK2MSFTNGP14.phx.gbl...

Asgard Hostmaster · Guest

Glen, would you happen to know of a good reference for setting up
replication via VPN? I've successfully connected my two servers with RRAS
however NTFRS insists on using the DNS names for replication which are
registered with the internet IPs. Any advice appreciated!

thanks,
david

"Glenn L" <the.only@gmail.com> wrote in message
news:%235j8FxutEHA.1720@TK2MSFTNGP14.phx.gbl...

Asgard Hostmaster · Guest

Ahh well, I managed to get the VPN up and running fine, but I'm still
getting the same errors in the NTFRS log. Namely -

**********
<FrsDsFindComputer: 3644: 8806: S2: 00:14:56> :DS: Settings reference is
cn=ntds
settings,cn=sb-3,cn=servers,cn=san-antonio,cn=sites,cn=configuration,dc=mydomain,dc=net
<FrsDsGetSubscribers: 3644: 8239: S0: 00:14:56> :DS: No NTFRSSubscriber
object found under cn=dfs volumes,cn=ntfrs subscriptions,cn=sb-3,ou=domain
controllers,dc=mydomain,dc=net!
<FrsDsGetSubscribers: 3644: 8239: S0: 00:14:56> :DS: No NTFRSSubscriber
object found under cn=2076db4e-718a-4a61-ac1d-9ae239578d26,cn=dfs
volumes,cn=ntfrs subscriptions,cn=sb-3,ou=domain
controllers,dc=mydomain,dc=net!
<RcsCreateSeedingCxtion: 2108: 6938: S0: 00:14:56> :X: ERROR - no parent
computer for DFSROOT|ASGARDWEB : WStatus: ERROR_FILE_NOT_FOUND
**********

and

**********
<SndCsMain: 3512: 867: S0: 00:16:18> :SR: Cmd 00ea7c50, CxtG 222709df, WS
ERROR_ACCESS_DENIED, To SB-2.mydomain.net Len: (356) [SndFail - rpc call]
<SndCsMain: 3512: 889: S0: 00:16:18> :SR: Cmd 00ea7c50, CxtG 222709df, WS
ERROR_ACCESS_DENIED, To SB-2.mydomain.net Len: (356) [SndFail - Send
Penalty]
**********

So it looks like it's not a firewalling problem :-(

"Asgard Hostmaster" <hostmaster@_remove_asgard.net> wrote in message
news:%23HWrVqxtEHA.3788@TK2MSFTNGP09.phx.gbl...

Glenn L · Guest

Yes...FRS still has lots of room for improving the ease of troubleshooting
(i.e. KBs)

Rather than setup VPN structure, there is an easier way. Assuming your
router admins are willing to open one port.
You can force FRS replication to use a specific high RPC port.
http://support.microsoft.com/default.aspx?scid=kb;en-us;319553

Also, here is the "all inclusive" link for Windows server system port
requirements.
http://support.microsoft.com/default.aspx?scid=kb;en-us;832017

--
Glenn L
CCNA, MCSE 2000, MCSE 2003 + Security

"Asgard Hostmaster" <hostmaster@_remove_asgard.net> wrote in message
news:%23HWrVqxtEHA.3788@TK2MSFTNGP09.phx.gbl...

Glenn L · Guest

Blast....FRS !@#$%

FRS: Error 13508 Goto page 1, 2 Next